Premium sign-in and re-authentication

A premium account is a real game account. CubeMind never sees its password.

Signing in

1. Choose to add a premium account.
2. CubeMind shows a short code.
3. Enter it on the account provider's sign-in page and approve the sign-in there.
4. The provider returns a token, which is stored encrypted.

The token never leaves the API process, and it is never returned to the browser or written into a log.

When it expires

Premium tokens do not last forever. An expired one shows Refresh needed, with two options:

• Refresh now: tries the stored token again. If the provider still accepts it, you are done.
• Sign in again: repeats the device-code sign-in. Needed when the token is genuinely gone.

A client whose account needs a refresh will not connect until it is fixed.

After re-authenticating

Once the account is valid again, its clients can use it. If you added a second entry for the same account while the first was stale, you can remove the old one, but check first what uses it: removing an account deletes the clients that depend on it.

Bans

A Banned status is the game's, not ours. Nothing on this side will change it; the account needs to be resolved with the game's publisher, or replaced.

One account, one client at a time

Two clients cannot play as the same account simultaneously: the server will not have it, and they will fight over the session. Give each running client its own account.